162.141.111[.]227IP address
Reported by 2 independent sources · first reported by Trend Micro Research · last reported
Last reported 4 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
ClickFix Campaign Generated Via AI Delivers SmartRAT“The fallback C2 is an IP address that is decrypted using XOR with the key 233, resolving to 162.141.111[.]227.”
-
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud“162.141.111[.]227”
Indicators reported together
named in the same reports- cartaobb[.]comin 1 report
- cartaobrb.com[.]brin 1 report
- hxxp://64.95.13[.]238/st.txtin 1 report
- 64.95.13[.]238in 1 report
- hxxp://64.95.13[.]238/payload.phpin 1 report
- c.windowsupdate-cdn[.]comin 1 report
- crefisa[.]onlinein 1 report
- vfsgloball[.]netin 1 report
- windowsupdate-cdn[.]comin 1 report
- 297eb45f028d44d750297d2f932b9c91in 1 report
- 6bf4d4c62b5138ace281ce3d08297787in 1 report
- 3c72e1f37f115b00c3ad6ed31bacfe8ain 1 report
- b17ccdb5531555e43f082d6e77c07227in 1 report
- hxxps://convitemundial2026[.]com/Consultar_NF-e.batin 1 report
- convitemundial2026[.]comin 1 report
- hxxp://24.199.90[.]58/payload.phpin 1 report
- 24.199.90[.]58in 1 report
- windowsk-cdn[.]comin 1 report
- c.windowsk-cdn[.]comin 1 report
- cdn[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.